Privacy Notice
In force from 6 November 2026.
This notice explains what personal data Crit Happens collects, why, who else handles it, how long it's kept, and your rights under the EU General Data Protection Regulation (GDPR). In short: we keep only what's needed to run your account and the game, we don't show ads, we don't use analytics, and we never sell your data.
1. Who is responsible
The controller of your data is [Your full name], [Your postal address], a private individual who makes and runs Crit Happens. Email: contact@crithappensgame.online. There is no data protection officer (one isn't required).
2. What we keep, and why
| Data | Why | Legal basis (GDPR) | How long |
|---|---|---|---|
| Account: account name, email address, password (only as a salted, one-way hash: we can't read your password), character name and body, sign-up and last login dates, which terms you accepted and when, your confirmation that you're at least 16 | To create and run your account, let you log in, confirm your email, reset your password and send important notices | Contract, Art. 6(1)(b) | Until you delete your account |
| Game data: your character's level and skills, items, equipment, storage, quests, position in the world, guild membership, market listings, and letters sent to you | To run the game and keep your progress | Contract, Art. 6(1)(b) | Until you delete your account or the game is reset. Market price history is kept without names. |
| Chat messages | To deliver them to other players, and to deal with abuse | Contract, Art. 6(1)(b); legitimate interest in moderation, Art. 6(1)(f) | Shown in game windows while playing; also written to the server's log file, which is replaced when the server restarts and kept at most 30 days |
| Security data: IP addresses of requests to the account service, counts of failed logins, website sign-in sessions (a random code), one-time email links | To protect accounts from break-ins and the service from abuse | Legitimate interest in security, Art. 6(1)(f) | IP addresses and login counts: in the server's memory only, at most 24 hours. Sign-in sessions: 30 days or until you sign out. Email links: 1 hour (password reset) to 3 days (email confirmation). |
| Backups of the game database (everything above except security data) | To recover from failures | Legitimate interest, Art. 6(1)(f) | The 14 most recent daily copies; deleted data disappears from them within 14 days |
| Emails we send you | Account emails only: confirming your address, password resets, notices about your account or the game. No newsletters or advertising. | Contract, Art. 6(1)(b) | Our email provider keeps delivery records as described in section 3 |
We don't ask for your real name, address, phone number, birth date or payment details. The game doesn't use your camera, microphone or location.
You need to give your account name, email address and password to have an account: without them we can't create one.
3. Who else handles your data
We use these services to run Crit Happens. They handle data on our behalf, or as needed to provide their service:
- Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA: hosts this website, runs the domain, connects the website to the account service, and provides the bot check (Turnstile) on sign-up and password reset forms. It sees your IP address and technical details of your browser.
- Plus Five Five, Inc. ("Resend"), 2261 Market Street #5039, San Francisco, CA 94114, USA: sends our emails. It receives your email address and the email's content.
- Developed Methods LLC ("playit.gg"), USA: relays the game's network traffic to our server, so it sees your IP address while you play. It handles this under its own privacy policy.
- GitHub, Inc., 88 Colin P Kelly Jr St, San Francisco, CA 94107, USA: hosts the game's downloads. When you open our front page, your browser asks GitHub for the newest version, so GitHub sees your IP address.
These companies are in the United States. Transfers to them are protected by the EU-U.S. Data Privacy Framework where the company is certified, and by the European Commission's Standard Contractual Clauses.
The AI game master runs on our own computer. It gets information about the game world (such as characters' levels and recent events), never your email address or account details, and nothing is sent to outside AI companies.
We don't sell or rent your data, and we don't share it with advertisers. We would only give it to authorities if the law required us to.
4. Your rights
You have the right to:
- see the data we have about you, and get a copy: use "Download my data" on your account page, or ask us;
- correct it: change your email on your account page, or ask us for anything else;
- delete it: use "Delete account" on your account page, or ask us;
- take it with you (data portability): the download is a standard JSON file;
- restrict how we use it, and object to uses based on our legitimate interest.
To use a right, write to contact@crithappensgame.online from the email address on your account. We answer within one month. It's free.
You can also complain to the Hungarian data protection authority: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), 1055 Budapest, Falk Miksa utca 9-11; postal address 1363 Budapest, Pf. 9; phone +36 1 391 1400; email ugyfelszolgalat@naih.hu; www.naih.hu. If you live in another EU country, you can complain to the authority there. You can also go to court.
5. Age
Crit Happens is for people aged 16 and over. If we learn that an account belongs to someone younger, we delete it.
6. Security
Your password never leaves your computer in readable form: the game and this website send a scrambled version, which the server scrambles again with a random salt (PBKDF2, 60,000 rounds). Website sign-ins and email links are long random codes, stored only in scrambled form. The website and the account service only work over HTTPS. Only we have access to the server and its backups.
7. Automated decisions
We don't make decisions about you by automated means that have legal or similarly significant effects. Automatic security limits (for example a one-minute lock after too many wrong passwords) only slow down attempts to break in.
8. Cookies
This website uses one cookie, only to keep you signed in. See Cookies and local storage.
9. Changes
If we change this notice, we'll update the date at the top and announce important changes on this website or by email.